What is shadow IT and why is it a risk?
Shadow IT—Software used by employees without IT approval—is bigger and riskier than most organisations realise. What it is, how it arises, and how to address it.
- 25 August 2026
- 5 min
Shadow IT is one of the biggest blind spots in Software management at Enterprise organisations. It includes all technology used by employees without IT or procurement approval: apps, cloud storage and communication tools. And it is larger than most organisations realise.
How does shadow IT arise?
Almost always from a genuine need. An employee needs a tool; approval takes too long or the IT alternative is clunky. The shortest route is a free account or a small subscription on the corporate credit card.
What starts with one person quickly grows. Colleagues join in, files are shared via unapproved platforms, and sensitive company data ends up with parties with whom no agreements exist.
Why is shadow IT a problem?
1. Security risks. Unapproved tools are not assessed, not updated and not monitored.
2. Compliance risks. Data processed via these tools falls outside your control, while your organisation remains responsible under the GDPR.
3. Waste. You pay for central tools while employees also use other tools that do the same.
Shadow IT and the Cybersecurity Act
Since 15 August 2026, the Cybersecurity Act—the Dutch implementation of NIS2—applies in the Netherlands. Organisations subject to it must manage risks in their supply chain, including their ICT suppliers. Shadow IT makes this overview inherently incomplete.
How do you tackle shadow IT?
Don’t start by banning but by understanding. Why do employees use certain tools and what is missing in the approved options? Analyse credit card statements, expense claims and invoices for unknown subscriptions, ask employees which tools they use and consolidate the findings with IT and procurement.
Also watch out for the latest variant: departments purchasing AI tools themselves. Read more in our article Shadow AI: the new shadow IT.
How SoftVaro helps
SoftVaro maps your entire Software landscape, including tools purchased outside IT. Afterwards, we help you consolidate to Software with robust commercial terms.
Frequently Asked Questions
The most commonly asked questions on this topic.
What exactly is shadow IT?
Shadow IT is all Software and technology used by employees without IT or procurement's approval or knowledge, such as free tools, personal cloud storage or unapproved communication platforms.
How do you identify what shadow IT exists in your organisation?
Start with credit card statements, expenses and invoices. Also ask employees which tools they use and supplement that with data from your IT management or SAM tooling.
Does shadow IT have implications under the Cybersecurity Act?
The Cybersecurity Act obliges organisations subject to it to manage risks in their supply chain. Software purchased outside IT is included in this.
Ready to save on software?
SoftVaro negotiates the best deal for you with over 4,000 suppliers. Independent, transparent, within 24 hours.